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Naval  Research  Laboratory  Preparation  for  Year  2000 
Executive  Summary 


Introduction.  This  report  is  one  of  a  series  of  reports  being  issued  by  the  Inspector 
General,  DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information 
Officer,  DoD,  to  monitor  DoD  efforts  in  addressing  the  year  20(X)  computing  problem. 
Information  technology  systems  have  typically  used  two  digits  to  represent  the  year, 
such  as  “98”  representing  1998,  to  conserve  electronic  data  storage  ^d  reduce 
operating  costs.  With  tiie  two-digit  format,  however,  the  y^  2000  is  indistinguishable 
from  1900.  As  a  result  of  die  ambiguity,  computers,  associated  systems,  and 
application  programs  that  use  dates  to  calculate,  compare,  and  sort  could  generate 
incorrect  results  when  working  with  years  after  1999. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  whether  the  Naval 
Research  Laboratory  is  adequately  preparing  its  information  technology  systems  to 
resolve  date-processing  issues  regarding  the  year  2000  computing  problem. 

Specifically,  the  audit  determined  whether  the  Naval  Research  Laboratory  complied 
with  the  Department  of  the  Navy  Year  2000  Action  Plan. 

Audit  Results.  The  Naval  Research  Laboratory  had  not  developed  a  comprehensive 
year  2000  activity  plan,  developed  a  comprehensive  inventory  of  information 
technology  systems,  examine  ongoing  research  efforts  for  a  potential  year  20(K)  impact, 
and  modified  contracts  to  ensure  receipt  of  only  year  2(XX)  compliant  products.  As  a 
result,  the  Naval  Research  Laboratory  could  not  yet  ensure  that  information  technology 
systems  and  ongoing  research  efforts  will  not  have  year  2000  date-processing  problems. 

Summary  of  Recommendations.  We  recommend  that  the  Conimander,  Naval 
Research  Laboratory,  develop  a  year  2000  activity  plan  that  includes  all  areas  of  the 
laboratory;  develop  a  comprehensive  inventory  of  ^1  hardware,  software,  and 
firmware;  develop  test,  contingency,  and  cost  plans  as  required  by  Navy  guid^ce; 
review  all  information  technology  research  efforts  for  the  potential  year  2000  impact; 
and  review  all  information  technology  contracts  for  inclusion  of  the  year  2000  contract 
provision. 

Management  Comments.  The  Office  of  the  Assistant  Secretary  of  the  Navy 
(Research,  Development  and  Acquisition)  concurred  with  the  finding  and 
recommendations.  See  Part  I  for  a  summary  of  management  comments  and  Part  III  for 
the  complete  text  of  tfie  comments. 
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Part  I  -  Audit  Results 


Audit  Background 

Year  2000.  The  year  2000  problem  is  the  term  most  often  used  to  describe  the 
potential  failure  of  information  technology  systems  to  process  or  perform 
date-related  functions  before,  on,  or  after  the  turn  of  the  centurjr.  The 
year  2000  problem  is  rooted  in  the  way  that  automated  information  systems 
record  and  compute  dates.  For  the  past  several  decades,  systems  have  typically 
used  two  digits  to  represent  the  year,  such  as  “98”  representing  1998,  to 
conserve  on  electronic  data  storage  and  to  reduce  operating  costs.  With  the 
two-digit  format,  however,  the  year  2000  is  indistinguishable  from  1900.  As  a 
result  of  the  ambiguity,  computers  and  associated  systems  and  application 
programs  that  use  dates  to  c^culate,  compare,  and  sort  could  generate  incorrect 
results  when  working  widi  years  following  1999.  Calculation  of  year  2000 
dates  is  further  complicated  because  the  year  2000  is  a  leap  year,  the  first 
century  leap  year  since  1600,  and  the  computer  systems  and  applications  must 
recognize  February  29,  2000,  as  a  valid  date. 

Because  of  the  potential  failure  of  computers  to  run  or  function  throughout  the 
Government,  the  President  issued  an  Executive  Order,  “Year  2000 
Conversion,”  February  4,  1998,  making  it  policy  that  Federal  agencies  ensure 
that  no  critical  Federal  program  experiences  disruption  because  of  the  year  2000 
problem  and  that  the  head  of  each  agency  ensure  ftiat  efforts  to  address  the  year 
2000  problem  receive  the  highest  priority  attention  in  the  agency. 

DoD  Year  2000  Management  Strategy.  In  his  role  as  the  DoD  Chief 
Information  Officer,  the  Acting  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  issued  the  “DoD  Year  2000 
Management  Plan”  (DoD  Management  Plan)  in  April  1997.  It  provides  the 
overall  DoD  strategy  and  guidance  for  inventorying,  prioritizing,  repairing,  or 
retiring  systems,  and  monitoring  progress.  The  DoD  Management  Plan  states 
that  the  DoD  Chief  Information  Officer  has  overall  responsibility  for  overseeing 
the  DoD  solution  to  the  year  2000  problem.  Also,  it  makes  the  DoD 
Components  responsible  for  implementing  the  five-phase  year  2000  management 
process.  The  “DoD  Management  Plan,  For  Signature  Draft  Version  2.0,”  June 
1998,  accelerates  the  target  completion  dates  for  the  renovation,  validation,  and 
implementation  phases.  The  new  target  completion  date  for  implementation  of 
mission-critical  systems  is  December  31,  1998. 

In  a  January  20,  1998,  memorandum  for  the  heads  of  executive  department  and 
agencies,  the  Office  of  Management  and  Budget  established  a  new  target  date  of 
March  1999  for  implementing  all  corrective  actions  to  all  systems.  The  new 
target  completion  dates  are  September  1998  for  the  renovation  phase  and 
January  1999  for  the  validation  phase. 

The  Secretary  of  Defense  issued  the  memorandum  “Year  2000  Compliance”  on 
August  7,  1998,  and  stated  that  the  year  2000  computer  problem  is  a  critical 
nation^  defense  issue.  He  also  stat^  that  the  Defense  agencies  will  be 
responsible  for  ensuring  that  the  list  of  mission-critical  systems  under  their 
respective  purview  is  accurately  reported  in  the  DoD  year  2000  database 
effective  October  1,  1998.  Defense  agencies  must  report  and  explain  each 
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change  in  mission-critical  designation  to  the  Offices  of  the  Assistant  Secretary 
of  Defense  (Command,  Control,  Communications,  and  Intelligence)  within 
1  month  of  the  change. 

The  Deputy  Secretary  of  Defense  issued  the  memorandum  “Year  2000  (Y2K) 
Verification  of  National  SecuriW  Capabilities”  on  August  24,  1998.  The 
memorandum  states  that  each  oi  the  Directors  of  the  Defense  Agencies  must 
certify  that  they  have  tested  the  information  technology  and  national  security 
system  year  2000  capabilities  of  their  respective  Component’s  systems  in 
accordance  with  the  DoD  Management  Plan. 

Department  of  the  Navy  Year  2000  Action  Plan.  The  Department  of  the 
Navy  Year  2000  Action  Plan  (the  Navy  Action  Plan)  implements  the  DoD 
Management  Plan.  The  Navy  Action  Plan  was  issu^  by  the  Department  of  the 
Navy  Chief  Information  Officer,  who  is  responsible  for  providing  assistance  and 
oversight  to  Navy  organizations  in  resolving  the  year  2000  problem.  The  Navy 
Action  Plan  provides  the  Navy  strategy  and  management  approach  to  satisfying 
the  year  2000  problem.  The  Navy  Action  Plan  is  the  Nav^  approach  to  the 
year  2000  problem  and  allows  Navy  organizations  to  modify  the  approach  to 
meet  the  needs  of  the  organizations.  The  Navy  Action  Plan  discusses  each  of 
the  five  phases  identified  in  the  DoD  Management  Plan  and  establishes  Navy 
target  completion  dates  for  each  phase.  The  five  phases  are  discussed  as 
follows. 

•  Phase  I  -  Awareness.  Familiarize  Navy  personnel  of  the  possible 
year  2000  impact,  define  the  year  2000  problem,  decide  the  organization 
approach,  and  obtain  high-level  management  support.  Awareness  is 
accomplished  through  orjganization  memorandums,  articles  in  Navy 
publications,  e-mails,  briefings,  site  visits,  and  other  means  as  appropriate. 
Target  completion  of  the  awareness  phase  was  December  1996. 

•  Phase  n  -  Assessment.  Determine  the  impact  of  the  year  2000  on  the 
organization’s  inventory  including  hardware,  software,  and  firmware,  and 
develop  acceptable  solutions;  estimate  resource  requirements  to  accomplish 
year  2000  solutions;  and  develop  contingency  plans  for  the  organization.  Target 
completion  of  the  assessment  phase  was  June  1997. 

•  Phase  in  -  Renovation.  Develop  the  actual  correction  of  the 

year  2000  problems  for  each  system.  Target  completion  of  the  renovation  phase 
was  June  1998. 

•  Phase  IV  -  Validation.  Test  and  verify  the  correctness  of  the 
renovated  or  replaced  systems.  All  systems  must  undergo  the  validation 
process,  including  systems  assessed  as  having  no  year  2000  impact.  Target 
completion  for  the  validation  phase  is  October  1998. 

•  Phase  V  -  Implementation.  Systems  are  considered  fully  operational 
after  being  certified  as  year  2000  compliant.  Target  completion  date  is 
December  1998. 
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Naval  Research  Laboratory.  The  Naval  Research  Laboratory  (NBi)  is  the 
Department  of  the  Navy’s  corporate  laboratory  and  is  the  principal  in-house 
component  in  the  Office  of  Naval  Research’s  effort  to  meet  its  science  and 
technology  responsibilities.  NRL  conducts  broad-based  scientific  research  and 
advanced  technological  developments  directed  toward  maritime  applications  of 
materials,  techniques,  equipment,  and  systems.  The  N^  is  conducting 
research  in  areas  including  computer  science  and  artificial  intelligence, 
electronic  warfare,  information  technology,  space  systems  and  technology,  and 
surveillance  and  sensor  technology. 


Audit  Objectives 

Our  primary  audit  objective  was  to  determine  whether  NRL  is  adequately 
preparing  its  information  technology  systems  to  resolve  date-processing  issues 
for  the  year  2000  computing  problem.  Specifically,  the  audit  determin^ 
whether  NRL  complied  wiA  the  Navy  Action  Plan.  Appendix  A  describes  the 
audit  scope  and  methodology  and  the  prior  audit  coverage. 
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Status  of  the  Naval  Research  Laboratory 
Year  2000  Program 

The  Naval  Research  Laboratory  (NRL)  had  not  developed  a 
comprehensive  year  2000  activity  plan,  developed  a  complete  inventory 
of  information  technology  systems,  examined  ongoing  research  efforts 
for  a  potential  year  2000  impact,  and  modify  contracts  to  ensure  receipt 
of  year  2000  compliant  products.  Those  conditions  existed  because  NRL 
did  not  fuUy  comply  with  the  Navy  year  2000  guidance.  As  a  result, 
NRL  could  not  yet  ensure  that  information  technology  systems  and 
ongoing  research  efforts  will  not  have  year  2000  date-processing 
problems. 


Awareness 

NRL  did  not  complete  the  awareness  phase  as  r^uired  in  the  Navy  Action  Plan, 
The  Navy  Action  Plan  required  Navy  organizations  to  complete  the  awareness 
phase  by  December  1,  1996.  The  intent  of  the  awareness  phase  is  to  make 
Navy  organization  personnel  aware  of  year  2000  concerns,  to  demonstrate 
upper-level  management  support  in  identifying  the  potenti^  for  exposure  to 
year  2000  problems  at  individual  Navy  organizations,  and  to  require  the 
development  of  an  individual  Navy  activity  plan.  N^  had  not  accompUshed 
the  following  two  key  elements  or  the  Navy  Action  Plan:  personnel  notification 
and  preparation  of  the  activity  plan. 

Personnel  Notification.  Year  2000  officials  at  NRL  did  not  inform  personnel 
of  year  2000  issues  trough  organization  memorandums,  articles  in  Navy 
publications,  e-mails,  briefings,  site  visits,  or  by  any  other  means.  NRL 
officials  plan  to  m^e  organization  personnel  aware  of  the  year  2000  problem 
when  solutions  to  fix  year  2000  problems  are  put  in  place. 

To  accomplish  organization-wide  year  2000  compliance,  the  NRL  officials  must 
make  personnel  aware  of  year  20()0  initiatives  before  they  can  make  solutions. 
Alerting  organization  personnel  of  the  year  2000  problem  and  showing  support 
firom  upper  management  in  identifying  and  resolving  any  potential  problems  are 
important  in  the  awareness  phase.  With  proper  notification,  organization 
personnel  can  become  part  of  the  identification  and  solution  process  and  cm 
assist  in  identifying  mission-support  systems  that  are  not  year  2000  compliant. 

Activity  Plan.  NRL  officials  had  not  prepared  an  NRL  activity  plan  that 
identifies  Ae  approach  in  identifying  and  resolving  the  potential  year  2000 
problem.  The  activity  plan  is  required  to  encompass  all  functional  elements  of 
NRL,  to  identity  year  2000  points  of  contact  assigned  to  areas  of  NRL,  to 
provide  guidance  to  inventoiying  systems,  to  provide  checklists  on  determining 
whether  systems  are  year  2000  compliant,  to  provide  test  plans  that  ensure  Aat 
systems  are  year  2000  compliant,  to  include  cost  plans  associated  with  making 
systems  year  2000  compliant,  to  identity  reporting  requirements,  to  establish 
contingency  plans,  and  to  require  the  identification  of  system  interfaces.  The 
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NRL  activity  plan,  which  was  in  development  during  the  audit,  included  only 
the  research  elements  of  NRL  and  excluded  business  and  infrastructure 
functional  areas  of  NRL.  NRL  did  not  develop  an  activity  plan  because  NRL 
was  not  following  guidance  issued  in  the  Navy  Action  Plan.  NRL  officials 
stated  that  the  Navy  Action  Plan  allows  for  flexibility  ^d  allows  Navy 
organizations  to  adapt  their  own  plan  to  fit  their  organizational  needs. 

However,  without  the  timely  development  of  the  activity  plan  and  the  inclusion 
of  all  functional  areas  of  N^,  NRL  did  not  have  a  corporate  approach  in 
identifying,  assessing,  and  resolving  potential  year  2000  problems. 


Assessment 

The  Navy  Action  Plan  states  that  during  the  assessment  pihase,  the  or^^zation 
must  determine  the  impact  of  the  year  2000  on  the  organization’s  activities. 

The  Navy  Action  Plan  requires  the  assessment  phase  to  include  a  complete 
inventory  of  all  hardware,  software,  and  firmware  for  technical,  business,  and 
infrastructure  areas  including  the  identification  of  all  internal  and  external 
system  interfaces;  to  begin  ^e  development  of  a  year  2000  contingency  plan;  to 
develop  test  plans;  and  to  identify  costs  associated  with  resolving  year  2000 
problems.  Also,  NRL  did  not  r^uire  assessments  of  current  research  programs 
for  a  potential  year  2000  impact.  The  Navy  Action  Plan  recommended  that 
organizations  complete  the  assessment  phase  as  of  June  30,  1997. 

Inventory,  NRL  did  not  develop  a  complete  inventory  of  hardware,  software, 
and  firmware  systems  as  required  by  the  Navy  Action  Plan.  The  inventory 
developed  by  NRL  officials  in  response  to  the  Navy  Action  Plan  excluded  the 
high-performance  computing  systems,  all  NRL  software,  the  systems  in  the 
NRL  local  network,  and  all  information  technology  purchases  made  trough 
purchase  orders  and  credit  cards.  The  NRL  inventory  did  appear  to  include  all 
business  hardware  and  software  systems  as  well  as  NRL  infrastructure  systems. 
The  NRL  year  2000  official  stated  that  the  officials  did  not  intend  to  develop  a 
complete  inventory  because  NRL  acquires  only  commercial  hardware  and 
software  that  is  already  year  2000  compliant,  only  a  small  amount  of  technical 
software  is  developed  by  NRL  personnel,  and  the  software  developed  is  not 
date-dependent.  The  NRL  year  2000  official  believes  that  the  risk  of 
experiencing  year  2000  problems  is  minimal,  and  the  costs  associated  with 
conducting  a  complete  inventory  were  not  warranted.  The  NRL  year  2000 
official  based  his  belief  about  limited  year  2000  risk  on  his  knowledge  of  all  the 
technical  information  technology  systems  at  the  laboratory. 

Contingency  Plan.  The  NRL  year  2000  official  did  not  initiate  preparation  of 
a  contingency  plan  because  he  believes  that  NRL  does  not  have  a  y^  2000 
problem.  The  official  believes  that  NRL  is  fully  capable  of  controlling  a 
year  2000  situation  without  a  formal  plan.  Also,  the  NRL  year  2000  official 
believed  that  developing  a  contingency  plan  during  the  assessment  phase  as 
required  by  the  Navy  Action  Plan  was  premature.  However,  considering  the 
unavoidable  and  quickly  approaching  century  changes,  contingency  planning 
becomes  even  more  critical  for  those  systems  not  assessed  for  the  year  2000 
impact  especially  when  a  comprehensive  inventory  has  not  been  developed. 
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Test  Plan.  NRL  has  not  developed  a  test  plan,  as  required  by  the  Navy  Action 
Plan,  for  confirming  year  2000  problem  corrections.  The  Navy  Action  Plan 
states  that  a  test  plan  should  describe  the  test  methodology,  test  phases, 
processes,  requirements,  and  schedules.  The  NRL  jrear  2000  official  stated  that 
two  mission-essential  systems  were  identified  as  having  a  year  2000  problem, 
and  those  systems  are  being  corrected  by  contractors.  N^  plans  to  perform  a 
validation  on  those  corrections;  however,  NRL  had  not  developed  a  test  plan  at 
Ae  time  of  this  review,  although  contractor  corrections  were  planned  for 
completion  by  the  summer  of  1998.  Also,  NRL  officials  stated  that  they  are  not 
planning  on  testing  other  commercially  acquired  hardw^e  ^d  software  systems 
at  NRL  because  vendor  statements  of  systems  provided  indicate  that  the  vendor 
systems  are  year  2000  compliant.  The  Navy  Action  Plan  recommends  testing  of 
systems  to  confirm  year  2000  compliance.  Examination  of  vendor  statements 
shows  that  they  recommend  that  organizations  still  conduct  testing  for  year  2000 
compliance  because  of  potential  unique  characteristics  at  each  user. 

Cost  Plan.  The  NRL  did  not  develop  a  cost  plan  for  expenditures  related  to 
year  2000  problems  as  required  by  the  Navy  Action  Plan.  The  NRL  year  2000 
official  stated  that  if  noncompliant  systems  exist  within  NRL,  those 
noncompliant  systems  would  be  replaced  as  normal  information  t^hnology 
upgrades  are  made.  The  associated  cost  is  considered  normal  maintenance  costs 
and,  therefore,  additional  year  2000  cost  is  considered  irrelevant. 

Assessment  of  Current  Research  Programs.  NRL  did  not  assess  the  potential 
year  2000  impact  on  ongoing  research  programs  including  potential  system 
interfaces  or  the  systems  that  the  research  programs  may  be  applied  to.  NRL 
conducts  research  and  development  programs  in  the  wliection,  transmission, 
and  processing  of  information  to  provide  a  basis  for  improving  the  conduct  of 
military  operations.  NRL  management  officials  stated  that  research  and 
development  programs  were  not  examined  by  program  managers  or  engineers 
because  NRL  managers  believe  that  none  of  the  programs  are  date-dependent 
and,  therefore,  will  have  no  year  2000  impact. 


Contracting 

The  Acting  Assistant  Secret^  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  a  policy  memorandum  to  the 
Secretaries  of  the  Military  Departments  and  the  Directors  of  the  Defense 
agencies  on  “Acquisition  of  Year  2000  Compliant  Information  Technology  (TT) 
and  Bringing  Existing  IT  Into  Compliance,”  December  18,  1997.  The 
memorandum  requires  the  review  of  information  technology  contracts  and  other 
acquisition  instruments  to  determine  whether  modifications  to  the  contracts  are 
necessary.  The  memorandum  states  that  orders  for  information  technology  shall 
not  be  placed  on  a  contract  or  other  acquisition  instrument  unless  the 
information  teclmology  purchase  is  year  2000  compliant. 

NRL  did  not  review  information  technology  contracts  as  required  by  the  Acting 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  memorandum  and  did  not  include  the  year  2000  coinpliance  clause 
in  all  contracts  awarded  after  December  18,  1997.  NRL  did  begin  to  include 
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the  year  2000  clause  in  its  information  technology  laboratory-wide  contracts  in 
April  1998.  However,  NRL  made  an  information  technology  purchase  of 
$135,000  for  which  the  NRL  order  did  not  contain  the  year  2000  requirement. 
In  addition,  NRL  personnel  used  NRL  credit  cards  and  purchase  orders  to 
acquire  information  technology  equipment  and  softw^e,  and  the  purchases  did 
not  contain  the  required  year  2000  compliance  provision.  NRL  contracting 
officials  stated  that  they  did  not  include  the  year  2000  compliance  statement  in 
the  information  technology  contracts  because  the  next  higher  command  did  not 
notify  them  of  the  requirement  until  April  1998. 

NRL  should  review  all  purchases  of  undelivered  information  technology  that 
were  awarded  before  April  1998,  determine  whether  the  information  technology 
products  are  required  to  be  year  2000  compliant,  and  modify  contracts 
accordingly  with  appropriate  year  2000  compliance  language. 


Conclusion 

The  NRL  officials  stated  that  Navy  organizations  are  allow^  flexibility  in  using 
the  Navy  Action  Plan  to  meet  individual  needs  of  the  organization,  and  are  not 
required  to  follow  the  Navy  Action  Plan.  As  a  result,  NItL  chose  not  to  follow 
the  process  for  identifying  year  2000  impact  as  recommended  in  the  Navy 
Action  Plan.  In  addition,  the  Commander,  NRL,  stated  that  he  was  satisfied 
with  the  approach  that  the  NRL  year  2000  officials  are  taking,  that  he  would 
certify  that  systems  used  at  the  NRL,  and  that  their  interfaces  will  not  be 
affected  by  transitioning  to  the  year  2000.  However,  if  NRL  does  not  take 
actions  outlined  in  this  report,  NRL  cannot  adequately  identify  and  minimize 
potential  year  2000  problems. 


Recommendations  and  Management  Comments 


We  recommend  that  the  Commander,  Naval  Research  Laboratory: 

1.  Develop  a  Naval  Research  Laboratory  activity  plan  to  include  all  areas 
of  the  laboratory  based  on  the  Department  of  the  Navy  Year  2000  Action 
Plan  guidance. 

Management  Comments.  The  Office  of  the  Assistant  Secretary  of  the  Navy 
Research,  Development  and  Acquisition)  concurred,  stating  that  NRL  has  now 
developed  a  year  2000  activity  plan. 

2.  Develop  a  complete  inventory  list  of  all  Naval  Research  Laboratory 
hardware^  software,  and  firmware,  including  purchases  with  credit  cards 
and  delivery  orders. 

Management  Comments.  The  Office  of  the  Assistant  S^retary  of  the  Navy 
(Research,  Development  and  Acquisition)  concurred,  stating  that  NRL  inventory 
has  a  planned  completion  date  of  September  30,  1998. 
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3.  Develop  test,  contingency,  and  cost  plans  as  required  by  the  Department 
of  the  Navy  Year  2000  Action  Plan  gui^nce. 

Management  Comments.  The  Office  of  the  Assistant  S^retary  of  the  Navy 
(Research,  Development  and  Acquisition)  concurred,  stating  that  NRL  is  in  the 
process  of  developing  test,  contingency,  and  cost  plans,  with  a  planned 
completion  date  of  October  30,  1998. 

4.  Review  all  information  technology  research  efforts  to  determine  whether 
the  research  has  a  potential  year  2000  impact  and  initiate  the  nectary 
corrective  action.  The  review  should  include  any  planned  system  interfaces 
necessary  for  the  information  technology  research  effort. 

Management  Comments.  The  Office  of  the  Assistant  Secretary  of  the  Navy 
(Research,  Development  and  Acquisition)  concurred,  steting  that  NRL  will 
assess  all  ongoing  research  efforts  for  year  2000  compliance.  Planned 
completion  of  the  research  assessment  is  January  1999. 

5.  Review  all  existing  contracts  or  other  acquisition  instruments  for 
information  technology  and  modify  contracts  for  the  year  2000  compliance 
requirement,  where  appropriate. 

Management  Comments.  The  Office  of  the  Assistant  Secretary  of  the  Navy 
(Research,  Development  and  Acquisition)  concurred,  stating  that  NRL  is 
currently  reviewing  applicable  contracts. 
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Part  II  -  Additional  Information 


Appendix  A.  Audit  Process 


This  in  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 

For  a  listing  of  audit  projects  addressing  this  issue,  see  the  year  2000  webpage 
on  IGnet  at  <http://www.ignet.gov> . 


Scope 

Work  Performed.  We  reviewed  and  evaluated  the  progress  of  NRL  in 
resolving  the  year  2000  computing  issue.  We  evaluated  the  year  2000  efforts  of 
NRL;  compared  the  actions  with  die  Navy  Action  Plan;  conducted  discussions 
with  technical,  business,  and  contracting  officials;  and  evaluated  year  2000 
documentation  where  available. 

DoD- Wide  Corporate-Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  DoD  has 
established  6  DoD-wide  corporate-level  performance  objectives  and  14  goals  for 
meeting  those  objectives.  This  report  pertains  to  achievement  of  the  following 
objective  and  go^: 

•  Objective:  Prepare  now  for  the  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  warfighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  for  the  following  functional  area  objective  and 
goal: 

Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  service  that  satisfies  customer  information 
ne^s. 

•  Goal:  Upgrade  technology  base.  (nM-2.3) 

General  Accounting  Office  High-Risk  Area.  In  its  identification  of  risk 
areas,  the  General  Accounting  Office  has  specifically  designated  risk  in 
resolution  of  the  year  2000  problem  as  high.  This  report  provides  coverage  of 
that  problem  and  of  the  overall  Information  Management  and  Technology  high- 
risk  area. 
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Methodology 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  during 
May  1998,  in  accordance  with  auditing  standards  issued  by  the  Comptroller 
General  of  the  United  States,  as  implemented  by  the  Inspector  General,  DoD. 
We  did  not  rely  on  computer-processed  data  or  statistics  sampling  procedures 
to  develop  conclusions  on  this  audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  for  this  audit  because  the  Secretary  of  Defense  Letter  of  Assurance  for 
FY  1997  recognizes  the  year  2000  issue  as  a  material  management  control 
weakness  area. 


Prior  Audit  Coverage 

The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have 
conduct^  multiple  reviews  related  to  year  2000  issues.  General  Accounting 
Office  reports  can  be  accessed  over  the  Internet  at  http://www.gao.gov. 
Inspector  General,  DoD,  reports  can  be  accessed  over  the  Internet  at 
http://www.dodig.osd.mil. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secreta^  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
DoD  Year  2000  Project  Officer 
Assistant  Secretary  of  Defense  (Public  Affairs) 

Department  of  the  Army 

Chief  Information  Officer,  Army 
Inspector  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Navy 

Commander,  Office  of  Naval  Research 

Commander,  Naval  Research  Laboratory 

Chief  Information  Officer,  Navy 

Inspector  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 
Chief  Information  Officer,  Air  Force 
Inspector  General,  Department  of  the  Air  Force 

Other  Defense  Organizations 

Director,  Ballistic  Missile  Defense  Organization 

Chief  Information  Officer,  Ballistic  Missile  Defense  Organization 
Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
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Other  Defense  Organizations  (cont’d) 

Chief  Information  Officer,  Defense  Information  Systems  Agency 
United  Kingdom  Liaison  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  Defense  Security  Assistance  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  S^urity  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 
Inspector  General,  National  Reconnaissance  Office 

Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  oii  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committ^  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Assistant  Secretary  of  the  Navy  (Research, 
Development  and  Acquisition)  Comments 


THE  ASSISTANT  SBCRETABY  OF  THE  NAVY 
(Research,  Development  and  Acquisition) 

WASHINGTON,  D.C.  20350-1000 

AUG  2  I  I998 

MEMORANDUM  FOR  THE  DEPARTMENT  OF  DEFENSE  ASSISTANT 
INSPECTOR  GENERAL  FOR  AUDITING 

Subj:  DRAFT  REPORT  ON  THE  AUDIT  OF  NAVAL  RESEARCH  LABORATORY 
PREPARATION  FOR  YEAR  2000  (PROJECT  NO.  8AB-0030.01) 

Ref:  (a)  DODIG  Memo  of  21  July  98 

End:  (1)  Department  of  the  Navy  Response  to  Draft  Audit  Report 


1  am  responding  to  the  draft  audit  report  forwarded  by  reference  (a)  concerning 
draft  report  on  the  audit  of  Naval  Research  Laboratory  preparation  for  Year  2000  (Project 
No.  8AB-0030.01). 

One  of  my  highest  priorities  in  the  Department  of  the  Navy  is  to  ensure  no  mission 
critical  system  failures  occur  due  to  Year  2000  (Y2K)  related  problems.  The  impact  of 
the  millennium  date  change  on  the  Department’s  many  information  technology  systems 
will  be  determined  largely  by  the  attention  we  devote  to  solving  the  Year  2000  (Y2K) 
processing  problem.  To  address  this  issue,  my  office  provided  guidance  which  outlines  a 
centralized  management/  decentralized  execution  policy.  The  Department’s  Y2K 
progress  is  reported  to  me  weekly  by  system  owners  during  regularly  scheduled  briefings. 
These  reports  examine  Echelon  II  Commands  for  proper  allocation  of  resources,  for 
progress  against  DON  and  DoD  mandated  milestones,  for  contingency  plans,  for 
responsibility  assignment  and  identification  of  system  interfaces,  for  required 
Memoranda  of  Agreement,  and  for  use  of  the  Department  of  the  Navy  Y2K  Database. 

The  Department  of  the  Navy  response  is  provided  at  enclosure  (1 ).  We  concur 
with  the  finding  and  recommendations  in  the  draft  report.  The  Commanding  Officer  of 
Naval  Research  Laboratory  takes  its  Y2K  responsibilities  seriously  and  has  taken 
appropriate  steps  to  ensure  that  the  conduct  of  the  Laboratory’s  mission  will  not  be 
adversely  affected  by  Y2K  induced  failures. 


Your  findings  and  recommendations  have  been  helpful  in  identifying  necessary 
changes  in  our  approach  to  solving  this  very  important  challenge.  My  point  of  contact  is 
CAPT  Clifford  Szafian,  (703)  602-6882. 


Assistant  Secretary  of  the  Navy  (Research,  Development  and  Acquisition) 

.  Comments^ 


Copy  To: 

CMC 

CNO 

UNSECNAV 

ASN(RD&A) 

Naval  Inspector  General 
Inspector  General  Marine  Corps 
Naval  Audit  Service 
USMC  CIO 

USNy2K  Project  Office 
NAVINSGEN(02) 

Office  of  Financi^  Operations  (FMO-31) 
ONR 

Naval  Research  Laboratory 
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Department  of  the  Navy  Response 
to 

DOD  Draft  Report  of  July  21,  1998 
on 

Naval  Research  Laboratory  Preparation  for  Year  2000 
(Project  No»  6AB-0030,01) 


PART  I  -  AUDIT  RESULTS 

STATUS  OF  THE  NAVAL  RESEARCH  LABORATORY  YEAR  2000  PROGRAM 
FINDING: 

The  Naval  Research  Laboratory  (NRL)  did  not  develop  a 
comprehensive  year  2000  activity  plan,  develop  a  complete 
inventory  of  information  technology  systems,  examine  ongoing 
research  efforts  for  a  potential  year  2000  impact,  and  modify 
contracts  to  ensure  receipt  of  year  2000  compliant  systems. 

Those  conditions  exist  because  NRL  did  not  fully  comply  with  the 
Navy  year  2000  guidance.  As  a  result,  NRL  cannot  ensure  that 
information  technology  systems  and  ongoing  research  efforts  will 
not  have  year  2000  date-processing  problems. 

DON  Response:  While  the  Department  of  the  Navy  Year  2000 
Action  Plan  was  used  as  the  basis  for  assessing  NRL  Y2K 
compliance,  the  plan  outlines  responsibilities  and  milestones 
and  provides  guidelines  for  Year  2000  activities  to  ensure  that 
no  DON  mission-critical  system  fails  due  to  Year  2000  problems. 
However,  the  recommendations  in  the  action  plan  are  high  level 
in  nature  and  are  to  be  considered  by  each  DON  project  team  as 
guidance.  Approaching  the  problem  in  this  fashion  ensures  a 
decentralized  effort,  allowing  each  organization  to  modify  the 
DON  'corporate  approach'  to  meet  its  needs.  The  management 
strategy  section  of  the  plan  allows  Department  of  the  Navy  (DON) 
components  the  flexibility  to  implement  solutions  as  deemed 
appropriate  while  benefiting  from  best  practices  in  a 
coordinated  effort. 

In  response  to  DON  y2K  tasking,  NRL  categorized  its 
information  technology  systems  as  DON  mission-critical,  NRL 
mission-critical,  NRL  mission-support,  or  non-mission  critical. 
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Systems  categorized  as  mission-critical  or  mission-support  are 
being  handled  with  the  highest  priority  and  in  close  adherence 
with  DON  policy.  For  non  mission-critical  systems,  NRL  is 
making  use  of  the  flexibility  provided,  within  the  DON  Action 
Plan  to  approach  the  Y2K  issue  in  the  most  cost-effective  manner 
consistent  with  meeting  critical  objectives*  Some  aspects  of 
the  finding  specifically  relate  to  NRL  exercising  this 
flexibility  for  non  mission-critical  systems. 

Page  5,  Awareness,  Personnel  Notification;  Year  2000  officials 
at  NRL  did  not  inform  personnel  of  year  2000  issues  through 
organization  memorandums,  articles  in  Navy  publications,  e- 
mails,  briefings,  site  visits,  or  by  any  other  means. 

DON  Response:  Concur*  Personnel  notification  was  not 
completed  by  1  December  1996.  However,  NRL  staff  have  been 
routinely  provided  with  all  DOD  and  DON  messages  and  other 
official  announcements  of  Y2K  problems.  The  press,  trade 
publications,  and  other  media  have  been  very  effective  in 
providing  insight  into  Y2K  concerns.  NRL  officials  advised  the 
auditors  that  NRL  was  preparing  a  web  site,  all-hands 
publications,  articles  for  the  Laboratory  newspaper  and  other 
means  of  promulgating  information,  requirements  and  solutions. 
Since  the  audit,  the  NRL  Y2K  web  site  has  been  released  for 
general  use  and  an  all-hands  publication,  Desktop,  distributed 
y2K  information.  The  NRL  Commanding  Officer  supports  this  and 
other  efforts  through  his  "Captain's  Corner"  on  the  NRL  main 
website.  Additional  publications  and  events  are  planned 
throughout  the  year.  The  nature  of  the  support,  scientific,  and 
engineering  workforce  of  NRL,  with  its  high  level  of  information 
technology  awareness,  should  permit  significant  flexibility  in 
implementing  Y2K  awareness  and  solutions. 

Page  5,  Activity  Plan;  NRL  officials  have  not  prepared  an  NRL 
activity  plan  that  identifies  the  approach  in  identifying  and 
resolving  the  potential  year  2000  problem. 

DON  Response:  Concur.  NRL' s  activity  plan  was  in  progress 
when  the  auditors  visited  NRL.  Components  of  this  activity  plan 
were  in  draft  or  being  executed  as  three  separate  elements 
addressing  scientific,  business,  and  infrastructure  areas.  A 
consolidated  activity  plan  has  since  been  developed  and  is  being 
reviewed.  Assessment  and  renovation  phases  for  the  most 
critical  components  of  NRL  infrastructure  addressed  in  this  plan 
were  already  well  underway  at  the  time  of  the  audit.  That 
process  is  continuing;  however,  some  elements  cannot  be 
completed  until  vendor-supplied  components  are  available.  This 
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is  not  expected  to  significantly  impact  subsequent  phases. 
Validation  and  implementation  phases  for  DON  mission-critical, 
NRL  mission-critical  and  NRL  mission-support  information 
technology  systems  should  be  completed  in  accordance  with  DON 
target  schedules. 

Page  6,  Assessment,  .Inventory:  NRL  did  not  develop  a  complete 
inventory  of  hardware,  software,  and  firmware  systems  as 
required  by  the  Navy  Action  Plan. 

DON  Response:  Concur.  NRL  has  a  complete  inventory  for 
all  mission-critical  and  mission-support  systems  at  the 
corporate  level.  These  mission  critical  and  mission  support 
systems  are  reported  in  the  DON  Y2K  Database.  An  inventory  of 
hardware  and  software  associated  with  these  systems  was  almost 
complete  at  the  time  of  the  audit.  The  inventory  of  hardware  and 
software  for  these  mission-critical  and  mission-support  systems 
will  be  available  by  September  30,  1998.  For  mission-critical 
and  mission-support  systems,  NRL  is  developing  test,  contingency 
and  cost  plans  as  required  by  Navy  guidance  and  recommended  by 
the  audit  report. 

IT  hardware  and  software  that  is  not  part  of  the  NRL  mission 
critical  and  mission  support  systems  will  be  reported  as 
infrastructure  devices  in  accordance  with  Chapter  14  of  the  DON 
Y2K  Action  Plan.  This  inventory  is  97%  complete  and  will  be 
reported  to  the  DON  Y2K  Database  by  30  September  1998,  NRL  is 
reviewing  options  to  capture  the  remaining  three  percent  of  the 
infrastructure  inventory. 

Page  6,  Contingency  Plan:  The  NRL  year  2000  official  did  not 
initiate  preparation  of  a  contingency  plan  because  he  believes 
that  NRL  does  not  have  a  year  2000  problem. 

DON  Response:  Concur.  NRL  is  developing  contingency  plans  for 
mission-critical  systems  as  required  by  Navy  guidance. 

Page  7,  Test  Plan:  NRL  has  not  developed  a  test  plan,  as 
required  by  the  Navy  Action  Plan,  for  confirming  year  2000 
problem  corrections. 

Page  7,  Cost  Plan:  NRL  has  not  developed  a  cost  plan  for 
expenditures  related  to  year  2000  problems  as  required  by  the 
Navy  Action  Plan. 

DON  Response:  Concur.  NRL  is  developing  test  and  cost 
plans  for  mission-critical  and  mission-support  systems  as 
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required  by  Navy  guidance.  The  plans  will  be  completed  by 
October  30,  1998. 

Page  7;  Assessment  of  Current  Research  Programs:  NRL  did  not 
assess  the  potential  year  2000  impact  on  ongoing  research 
programs  including  potential  system  interfaces  or  the  systems 
that  the  research  programs  may  be  applied  to. 

DON  Response:  Concur.  NRL  will  assess  all  ongoing 
research  efforts  for  Y2K  compliance.  This  will  be  accomplished 
as  part  of  the  awareness  program  and  through  the  program  review 
process.  The  FY99  process  begins  in  September  1998  for  FY99 
programs,  and  will  be  completed  by  early  January  1999. 

Page  1,  Contracting:  NRL  did  not  review  information  technology 
contracts  as  required  by  the  Acting  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence) 
memorandum  and  did  not  include  the  year  2000  compliance  clause 
in  all  contracts  awarded  after  December  18,  1997. 

DON  Response:  Concur.  NRL  has  not  yet  reviewed  ail 
existing  contracts  for  Y2K  compliance,  NRL  is  currently 
reviewing  applicable  existing  contracts. 

RECOMMENDATIONS  FOR  CORRECTIVE  ACTION: 

Recommendation  1.  Commanding  Officer,  Naval  Research 
Laboratory,  develop  a  Naval  Research  Laboratory  activity  plan  to 
include  all  areas  of  the  laboratory  based  on  the  Department  of 
Navy  Year  2000  Action  Plan  guidance. 

DON  Response:  Concur.  NRL  has  developed  a  Y2K  activity 

plan. 

Recommendation  2.  Commanding  Officer,  Naval  Research 
Laboratory,  develop  a  complete  inventory  list  of  all  Naval 
Research  Laboratory  hardware,  software,  and  firmware,  including 
purchases  with  credit  cards  and  delivery  orders. 

DON  Response:  Concur.  NRL  has  a  complete  inventory  for  all 
mission-critical  and  mission-support  systems  at  the  corporate 
level.  These  mission  critical  and  mission  support  systems  are 
reported  in  the  DON  Y2K  Database.  An  inventory  of  hardware  and 
software  associated  with  these  systems  was  almost  complete  at 
the  time  of  the  audit.  The  inventory  of  hardware  and  software 
for  these  mission-critical  and  mission-support  systems  will  be 
available  by  September  30,  1998.  For  mission-critical  and 
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Assistant  Secretary  of  the  Navy  (Research,  Development  and  Acquisition) 
Comments  ’ 


mission-support  systems,  NRL  is  developing  test,  contingency  and 
cost  plans  as  required  by  Navy  guidance  and  recommended  by  the 
audit  report* 

IT  hardware  and  software  that  is  not  part  of  the  NRL  mission 
critical  and  mission  support  systems  will  be  reported  as 
infrastructure  devices  in  accordance  with  Chapter  14  of  the  DON 
Y2K  Action  Plan,  This  inventory  is  97%  complete  and  will  be 
reported  to  the  DON  Y2K  Database  by  30  September  1998.  NRL  is 
reviewing  options  to  capture  the  remaining  three  percent  of  the 
infrastructure  inventory. 

Recommendation  3;  Commanding  Officer,  Naval  Research 
Laboratory,  develop  test,  contingency,  and  cost  plans  as 
required  by  the  Department  of  Navy  Year  2000  Action  Plan 
guidance. 

DON  Response:  Concur.  NRL  is  in  the  process  of  developing 
test,  contingency  and  cost  plans  as  required  by  Navy  guidance. 
The  plans  will  be  completed  by  October  30,  1998. 

Recommendation  4 ;  Commanding  Officer,  Naval  Research 
Laboratory,  review  all  information  technology  research  efforts 
to  determine  whether  the  research  has  a  potential  year  2000 
impact  and  initiate  the  necessary  corrective  action.  The  review 
should  include  any  planned  system  interfaces  necessary  for  the 
information  technology  research  effort. 

DON  Response:  Concur.  NRL  will  assess  all  ongoing 
research  efforts  for  Y2K  compliance.  This  action  will  be 
completed  by  January  1999. 

Recommendation  5:  Commanding  Officer,  Naval  Research 
Laboratory,  review  all  existing  contracts  or  other  acquisition 
instruments  for  information  technology  and  modify  contracts  for 
the  year  2000  compliance  requirement,  where  appropriate, 

DON  Response:  Concur.  NRL  is  currently  reviewing 
applicable  existing  contracts. 
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Audit  Team  Members 


The  Acquisition  Management  Directorate,  OfiSce  of  the  Assistant  Inspector 
General  for  Auditing,  DoD,  produced  this  report. 

Thomas  F.  Gimble 
Raymond  A.  Spencer 
Roger  H.  Florence 
Calvin  L.  Melvin 
Vonna  D.  Swigart 
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